fix(budget): bill metered LLM usage instead of a flat input-only estimate

[Mr-Neutr0n]

Fixes #586

Summary

Turn-level budget accounting now uses the metered usage each harness already reports per LLM request instead of a single flat, input-only estimate.

Root cause

recordModelCall fires once per turn with an estimated input-token count only, and the budget recorded estimateCostUsd(rec.inputTokens) from it: every model priced at DEFAULT_AGENT_INPUT_USD_PER_MTOK (5), no output or cache tokens. The measured numbers existed on a second callback the budget never saw: recordLlmRequest receives usage (input, output, cacheRead, cacheWrite, provider-computed costUsd) for every step.

What changed

• costFromUsage() in src/ratelimit/budget.ts: prefers the provider-reported costUsd, falls back to (input+output+cacheRead+cacheWrite) at the default rate when tokens are reported without cost, and returns 0 when nothing is reportable.
• The main turn path records budget from that metered usage inside the existing recordLlmRequest handler; the once-per-turn estimate is removed there so steps are not double-counted. Detect, compaction, and security-screen paths keep their existing estimates (they have no metered counterpart).

Verification

• 4 new cases in test/budget.test.ts: provider cost preferred, token-total fallback, missing metering bills zero, and output-only usage tripping an input-blind limit.
• npm test budget suite 8/8 pass; full existing budget tests unchanged and green.
• npm run typecheck clean, eslint/oxlint clean on touched files.

This change was prepared with AI assistance under human direction and review.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[time-attack]

Thanks for this, @Mr-Neutr0n — and sorry for the slow response.

We're closing this PR. Per CONTRIBUTING.md, since coding agents write most of the underlying code now, we'd rather receive feature ideas as a short human-written note in adrs/ — informal is great, just the idea in your own words — and bugs as a plain issue. If we're aligned we're happy to burn our own tokens on the implementation, and we'll credit you as co-author.

We don't want your idea to get lost, so we've captured it in #748 to triage on our side. Please feel free to open an adrs/ note if you feel strongly about the approach. Appreciate you engaging with the repo!